A quadratic time complexity bug in django.utils.http.parse_header_parameters() can cause a denial‑of‑service when an HTTP header value contains many separators inside a quoted parameter. Unauthenticated clients can send crafted Accept or Content‑Type headers, triggering the vulnerable parsing path in HttpRequest.accepts(); the per‑request length limit does not constrain the combined size of repeated headers, so an attacker can overwhelm the server’s CPU or memory while parsing a header.

Django releases prior to 6.1.2, 6.0.9, and 5.2.18 are affected. Earlier unsupported series such as 5.1.x, 5.0.x, and 4.2.x may also be vulnerable. The issue is present in the Django web framework and affects any deployment that processes HTTP headers without a mitigation in place.

The CVSS score of 6.9 denotes moderate severity, and no EPSS data is available. The vulnerability is exploitable out of band; no authentication is required and an attacker can trigger it by sending a single HTTP request with a malicious header. Because the algorithm degrades quadratically, repeated exploitation can lead to heavy resource consumption and denial of service, especially in high‑traffic environments. The vulnerability is not listed in the CISA KEV catalog, but the remote nature and low exploitation complexity elevate its risk for exposed Django applications.